CVE-2022-31089: 
JavaScript vulnerability analysis and mitigation

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, was found to contain a vulnerability (CVE-2022-31089) where certain types of invalid files requests are not handled properly and can crash the server. The vulnerability was disclosed on June 17, 2022, affecting versions <4.10.12 and >=5.0.0 <5.2.3 (GitHub Advisory).

The vulnerability stems from improper handling of invalid file requests, which can lead to server crashes. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and primarily impacting system availability (NVD).

The severity of the impact depends on the deployment configuration. For organizations running multiple Parse Server instances in a cluster, the availability impact may be low. However, for those running Parse Server as a single instance without redundancy, the availability impact may be high due to potential server crashes (GitHub Advisory).

The vulnerability has been patched in versions 4.10.12 and 5.2.3. Users are advised to upgrade to these or later versions. There are no known workarounds for this vulnerability (GitHub Advisory).